Division 10 listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: United States
• Announcement date: November 30, 2025

The dragonforce ransomware group has officially listed the United States-based company Division 10 on its leak site. According to the announcement made on November 30, 2025, the threat actor group claims to have successfully compromised the organization and is now asserting possession of its data.

The alleged attack and claims by dragonforce

The announcement, which surfaced on the group's leak site on November 30, 2025, marks a significant development in the ongoing threat landscape facing the organization. The dragonforce group alleges that they have carried out a successful attack against Division 10, claiming to have gained unauthorized access to the company's internal systems.

In their public claim, the group asserts that they have exfiltrated a substantial amount of information. Specifically, the threat actors claim to be in possession of approximately 126.74 GB of data belonging to the organization. This claim of data theft is a common tactic used by ransomware groups to increase pressure on their targets during extortion attempts.

Ransomware leak sites serve as a platform for cybercriminals to host stolen information, often using it as leverage to demand payments. This practice is frequently associated with double extortion tactics, where attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly to damage the victim's reputation or force compliance with ransom demands.

Details regarding the claimed data

While the dragonforce group has specified the total volume of the data they claim to have stolen, they have been notably vague regarding the specific contents of the files. The group has not provided any specific details regarding the nature of the leaked data, other than the claim of a 126.74 GB data set being compromised.

The listing names no specific data types that have been stolen.

About Division 10

Division 10 Inc is a company that has been providing specialty product supply, estimating services, and installation quotes to the construction industry since 1989. Their client portfolio ranges from contractors to automotive companies.

Risk assessment and organizational implications

This incident may pose a risk to the organization's operational processes and commercial reputation. The alleged leaked data could potentially contain customer information, contracts, or trade secrets, which may lead to legal obligations under various US state-level data protection regulations. The potential exposure of such sensitive information can result in significant regulatory scrutiny and long-term consequences for a firm's standing in the industry.

The nature of the threat actor also presents specific challenges. The fact that the dragonforce group reportedly utilizes a model providing infrastructure to affiliates may indicate that their attack vectors could be diverse. In such models, a central group provides the ransomware-as-a-service (RaaS) framework, while various affiliates carry out the actual breaches, meaning the methods used to enter a network can vary widely from one attack to another.

To mitigate the fallout from such an event, organizations often find it necessary to investigate the validity of these claims through comprehensive forensic analysis. Furthermore, once a breach is suspected, it is critical for organizations to warn their employees against potential secondary risks, such as targeted phishing attacks. Attackers often use stolen information to craft highly convincing social engineering campaigns aimed at further compromising the network or targeting specific individuals within the company.

General defensive measures

In the broader context of cybersecurity, organizations typically focus on several defensive layers to prevent such incidents. These include implementing robust access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized data exfiltration. Strengthening employee awareness training is also a fundamental step in defending against the social engineering tactics that often follow a data breach.